RuoYi-Vue-Plus contains a critical vulnerability in the snailjob component that allows attackers to perform arbitrary file read and write operations.

The /snail-job/workflow/check-node-expression interface fails to properly sanitize user-supplied input, allowing the exploitation of QLExpress expressions to manipulate the File class for arbitrary file system access.

An attacker can read sensitive configuration files or overwrite system files, potentially leading to full system takeover or sensitive data exposure. With a CVSS score of 9.4, this vulnerability represents an urgent threat that could be leveraged to gain persistence or elevate privileges.

Immediate Action: Update the RuoYi-Vue-Plus framework to the latest version where the snailjob input validation is corrected.

Proactive Monitoring: Monitor application logs for suspicious input patterns directed at the /snail-job/ endpoint and look for unexpected file modification activities.

Compensating Controls: Restrict access to the affected interface through network-level controls or WAF rules if immediate patching is not feasible.

Public Exploit Available: Unknown

The ability to perform arbitrary file operations constitutes a severe threat to system integrity. Security teams should prioritize patching this component immediately and audit the system for any signs of prior unauthorized access.